Fix #1192941 - stack-overflow

Bug: chromium:1192941
Change-Id: Ifb17736936df6f3b1ad6081e74d802be8897fe74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2787489Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73701}

src/objects/objects.cc

@@ -462,8 +462,12 @@ Handle<String> Object::NoSideEffectsToString(Isolate* isolate,
   if (input->IsString() || input->IsNumber() || input->IsOddball()) {
     return Object::ToString(isolate, input).ToHandleChecked();
   } else if (input->IsJSProxy()) {
-    HeapObject target = Handle<JSProxy>::cast(input)->target(isolate);
-    return NoSideEffectsToString(isolate, Handle<Object>(target, isolate));
+    Handle<Object> currInput = input;
+    do {
+      HeapObject target = Handle<JSProxy>::cast(currInput)->target(isolate);
+      currInput = Handle<Object>(target, isolate);
+    } while (currInput->IsJSProxy());
+    return NoSideEffectsToString(isolate, currInput);
   } else if (input->IsBigInt()) {
     MaybeHandle<String> maybe_string =
         BigInt::ToString(isolate, Handle<BigInt>::cast(input), 10, kDontThrow);